I like monitoring systems that make their assumptions obvious. Prometheus is one of them. It scrapes targets on a schedule, stores time series locally, evaluates rules, and fires alerts when conditions match. There is no mystery about where the numbers came from. If a graph looks wrong, I can usually inspect the raw metric in […]
Prometheus and Node Exporter for Linux Monitoring Read Post »
IIS has the most friction of any common web server when it comes to SSL certificate management. Not because it’s technically harder, but because the workflow is different from Linux-based servers and the GUI-heavy approach obscures what’s actually happening. I’ve set up SSL on IIS for clients a number of times, and each time I
Installing SSL Certificates on Windows Server IIS: Step-by-Step Guide Read Post »
Disk space has a way of filling up at the worst possible time. I’ve had databases refuse to write because /var was full, deployments fail because /tmp was full, and applications crash because their log directories hit quota. All of them were preventable with basic disk space management. Here’s how I handle it. Finding Large
Server Disk Space Management: Finding What’s Eating Your Storage Read Post »
SNI is one of those TLS features that quietly made modern HTTPS hosting practical. Most people never think about it until something breaks, and then it becomes the entire problem. I usually notice SNI only during troubleshooting: the wrong certificate shows up, a test succeeds against the IP but fails against the hostname, an old
SNI (Server Name Indication): How It Works and Why It Still Matters Read Post »
People love declaring iptables dead every few years. The kernel moved on, nftables is the direction of travel, and higher-level tools like UFW and firewalld are what many admins touch day to day. All of that is true. It is also true that I still run into iptables constantly: older hosts, minimal cloud images, vendor
iptables Firewall Practical Guide for Linux Read Post »
Self-signed certificates get a bad reputation because browsers show scary warning pages when they encounter them. But that reputation comes from misuse — using self-signed certs where a trusted certificate is needed. In the right context, a self-signed certificate is the correct tool. Here’s where I actually use them: internal APIs that communicate server-to-server, development
Self-Signed SSL Certificates: When to Use Them and How to Create Them Read Post »
I spent years using OpenVPN for internal VPNs and I was always mildly frustrated by it. The configuration files are long, the certificates require careful management, the performance is decent but not great, and debugging connection issues is painful. Then I tried WireGuard and everything got simpler. WireGuard is modern, fast, and has a remarkably
WireGuard VPN on Linux: Setup and Configuration Read Post »
SSH is one of the first services I lock down on a new server because it is usually the front door to everything else. If SSH is weak, the rest of your hardening work starts from a bad premise. If SSH is solid, you at least force attackers into harder, noisier, or less direct paths.
SSH Hardening: A Practical Guide for Production Servers Read Post »
PHP-FPM (FastCGI Process Manager) is how PHP runs behind Nginx. The two don’t talk to each other directly — Nginx hands PHP requests to PHP-FPM via FastCGI, PHP-FPM processes them, and sends responses back. Getting this configuration right affects both performance and stability. I’ve set this up dozens of times. Here’s what I’ve learned about
PHP-FPM and Nginx: Configuration and Performance Tuning Read Post »
I still write a lot of Bash. Not because Bash is elegant, and definitely not because it is my first choice for complex software, but because it is already on the server, it is fast to deploy, and it solves a lot of admin problems before Python would finish creating its virtual environment. The catch
Bash Scripting for Sysadmins: Practical Patterns and Real-World Examples Read Post »